Subject: [mobile-ip] Mipv6 issue #125: RH processing order inconsistency

From: Jari Arkko <[email-masked]>
Date: Fri, 27 Sep 2002 17:57:40 +0300

Section 11.2.3 states:

    A node receiving a packet addressed to itself (i.e., one of the
    node's addresses is in the IPv6 destination field) follows the next
    header chain of headers and processes them.  When it encounters
    a Type 2 Routing header during this processing it performs the
    following checks.
    ...
    Once the above checks have been performed, the node swaps the IPv6
    destination field with the Home Address field in the RH, decrements
    segments left, and resubmits the packet to IP for processing the
    next header.
    ...
    The definition of AH requires the sender to calculate the AH
    integrity check value of a routing header in a way as it appears in
    the receiver after it has processed the header.  Since IPsec headers
    follow the Routing Header, any IPsec processing will operate on
    the packet with the home address in the IP destination field and
    segments left being zero.

Section 9.6 states:

    ... The Destination Address in the packet's IPv6 header is set to
        the mobile node's care-of address ...

    ... The Routing header is initialized to contain a single route
        segment, with an Address of the mobile node's home address ...
    ...
    The IP layer will insert the routing header before performing IPsec
    processing.  The IPsec Security Policy Database will be consulted
    based on the IP source address and the final IP destination (which
    will be in the routing header).  The definition of AH ensures that
    the AH calculation is done on the packet in the form it will have on
    the receiver after advancing the routing header.

The first text fragment above indicates that when receiving RH2 traffic,
we end up with the home address in the IPv6 header before IPsec is
processed, and the number of segments left is 0. The second text fragment
doesn't clearly say anything about the order, but it appears like the
sender should create the final RH2 and then run IPsec; there is an
exception in the text for SPD checks but this will not be sufficient.
It is necessary to have the packet in the right form also.

Section 11.2.3 is right, and Section 9.6 should be corrected
accordingly.

Jari